Mojolicious 安全漏洞

Mojolicious is Mojolicious open source Perl-based real-time web framework. A security vulnerability exists in Mojolicious 9.39 and earlier versions, which stems from the use of an insecure rand function to generate weak HMAC session keys, which could lead to brute-force breaking of session keys...

BIT-MOODLE-2024-43427 Moodle: admin presets export tool includes some secrets that should not be exported

A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party...

Malicious code in wasitestforeducation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3143ff548280d35ca2611e7959f1e56224da26b7b8a56ce97c67509800fba81a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-49899 fscrypt: stop using keyrings subsystem for fscrypt_master_key

In the Linux kernel, the following vulnerability has been resolved: fscrypt: stop using keyrings subsystem for fscryptmasterkey The approach of fs/crypto/ internally managing the fscryptmasterkey structs as the payloads of "struct key" objects contained in a "struct key" keyring has outlived its...

CVE-2022-49820

In the Linux kernel, the following vulnerability has been resolved: mctp i2c: don't count unused / invalid keys for flow release We're currently hitting the WARNON in mctpi2cflowrelease: if midev-releasecount midev-i2clockcount WARNONCE1, "release count overflow"; This may be hit if we expire a...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview github.com/elastic/elastic-agent/internal/pkg/agent/application is a single, unified way to add monitoring for logs, metrics, and other types of data to a host Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere d...

Elastic Agent / Elastic Endpoint Security Security Update (ESA-2025-03)

Elastic Agent / Elastic Endpoint Security local API key disclosure ESA-2025-03 Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was...

MAL-2025-3567 Malicious code in array-length-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1eeb8fbe13dcffd2d78c2677d8add867f32dd32725416d8f2f71ff2df0ba6f62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3571 Malicious code in mymte2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc861b79eea3d82ab6dc25824fb7dad325622a6cbe4012fffe07ad7c198b4a73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3552 Malicious code in internal-payroll-lib-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38b57b13614231552ff2a81bd698a53edcac5cfcc943ef879a6a2e1de08d7fed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3549 Malicious code in deals1flash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8dedaefeb09b39504c5df2e0817c5259711dd5afd429d887aef2a263a8cb1de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-WFM2-RQ5G-F8V5 @account-kit/smart-contracts Allowlist Module Bypass Vulnerability

Summary Allowlist module contains a bypass vulnerability Details The logic for using an allowlist on a Modular Account V2 contained a bug that allowed session keys to bypass any allowlist configuration Action If you are using @aa-sdk and/or @account-kit/smart-contracts between the versions of...

@account-kit/smart-contracts Allowlist Module Bypass Vulnerability

Summary Allowlist module contains a bypass vulnerability Details The logic for using an allowlist on a Modular Account V2 contained a bug that allowed session keys to bypass any allowlist configuration Action If you are using @aa-sdk and/or @account-kit/smart-contracts between the versions of...

CVE-2025-3301

DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in exposure of confidential information. The best practice is to u...

CVE-2025-3301 DPA Countermeasures Unavailable for Certain Cryptographic Operations on Series 2 Devices

DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in exposure of confidential information. The best practice is to u...

CVE-2025-3301

CVE-2025-3301 concerns DPA countermeasures being unavailable for ECDH key agreement and EdDSA signing on Curve25519 and Curve448 on all Series 2 modules and SoCs due to lack of hardware and software support. The consequence is potential exposure of confidential information if a DPA attack is succ...

Malicious code in chai-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5af472e8e9f91924f3ec3b28eec6184f13eee63ed37c2873f4042d81171682c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3539 Malicious code in nsemea-sample-parenttransaction-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a41c3f9782e1fb062bef2307e7300491d25460f761f7e9da305bc92e541c850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3515 Malicious code in @baywa-re-lusy/nsemea-customer-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04cade6fe87118ba0ff073c78b84a484c6d2ec20889cf67ea74c255058b7d6e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-46329 Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs

libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage durin...